Bug 19257

Summary: Warn when reopening a basket
Product: Koha Reporter: Aleisha Amohia <aleisha>
Component: AcquisitionsAssignee: Aleisha Amohia <aleisha>
Status: RESOLVED FIXED QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: fridolin.somers, katrin.fischer, mtj
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: Sponsored Patch complexity: Small patch
Who signed the patch off: Text to go in the release notes:
Version(s) released in:
Attachments: Bug 19257: Prevent warn when reopening a basket
Bug 19257: Prevent warn when reopening a basket
Bug 19257: Prevent warn when reopening a basket

Description Aleisha Amohia 2017-09-05 21:15:56 UTC
CGI::param called in list context from package CGI::Compile::ROOT::home_vagrant_kohaclone_acqui_basket_2epl line 229, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
Comment 1 Aleisha Amohia 2017-09-05 21:17:39 UTC
Created attachment 66858 [details] [review]
Bug 19257: Prevent warn when reopening a basket

To test:
1) Go to Acquisitions, find a vendor and a basket (create if you don't
have either)
2) Close the basket
3) View the basket and reopen it
4) Notice the warn
5) Apply the patch and repeat steps 1-3
6) Notice the warn no longer shows and the basket is reopened as
expected

Sponsored-by: Catalyst IT
Comment 2 M. Tompsett 2017-09-06 03:58:50 UTC
Created attachment 66863 [details] [review]
Bug 19257: Prevent warn when reopening a basket

To test:
1) Go to Acquisitions, find a vendor and a basket (create if you don't
have either)
2) Close the basket
3) View the basket and reopen it
4) Notice the warn
5) Apply the patch and repeat steps 1-3
6) Notice the warn no longer shows and the basket is reopened as
expected

Sponsored-by: Catalyst IT

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 3 Jonathan Druart 2017-09-07 17:38:54 UTC
Created attachment 66957 [details] [review]
Bug 19257: Prevent warn when reopening a basket

To test:
1) Go to Acquisitions, find a vendor and a basket (create if you don't
have either)
2) Close the basket
3) View the basket and reopen it
4) Notice the warn
5) Apply the patch and repeat steps 1-3
6) Notice the warn no longer shows and the basket is reopened as
expected

Sponsored-by: Catalyst IT

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Jonathan Druart 2017-09-07 18:08:28 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 5 Fridolin SOMERS 2017-10-10 09:58:56 UTC
Pushed to 17.05.x, will be in 17.05.05.
Comment 6 Katrin Fischer 2017-10-14 12:03:04 UTC
This patch has been pushed to 16.11.x and will be in 16.11.13.
Comment 7 Mason James 2017-11-23 23:11:18 UTC
Pushed to 16.05.x, for 16.05.18 release